September 2022
2,210 CVEs published, −9% on August 2022 and +14% on September 2021. CISA added 24 to KEV.
2022 month by month
- Critical
- 29914% of the 2,157 with a CVSS score
- Added to CISA KEV
- 248 of this month's CVEs are in KEV, listed a median 96.5 days after publication
- Vendors
- 1,0204,047 products
- Top weakness
- Out-of-bounds WriteCWE-787 · 268 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Tensorflow, Chrome186103new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim12891new
- 3Ао "нппкт"Осон Основа Оnyx11523new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition11533new
- 5PyPITensorflow, Tensorflow-cpu, Tensorflow-gpu1144nonenew
- 6MavenCom.fasterxml.woodstox:woodstox-core, Com.liferay.portal:release.dxp.bom, Org.yaml:snakeyaml10814nonenew
- 7FedoraprojectFedora, Extra Packages For Enterprise Linux9833new
- 8MicrosoftWindows Server 2022, Windows Server 2022 (Server Core Installation), Windows Server 2019 (Server Core Installation)9044new
- 9Ооо «ред Софт»Ред Ос8381new
- 10DebianDebian Linux, Logcheck803nonenew
- 11ApplemacOS, iPhone OS, iPadOS7251new
- 12AdobeIndesign, Adobe Indesign, Experience Manager660nonenew
- 13TensorflowTensorflow590nonenew
- 14Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Virtualization582nonenew
- 15UnknownClassified Listing Pro - Classified Ads & Business Directory Plugin, Wp Popup Builder – Popup Forms , Marketing Popup & Newsletter, Post Smtp Mailer/email Log552nonenew
- 16QualcommWCD9370 Firmware, WCD9375 Firmware, WSA8835 Firmware545nonenew
- 17Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile545nonenew
- 18PackagistTypo3/cms-core, Typo3/cms, Moodle/moodle516nonenew
- 19GoGithub.com/rancher/rancher, Github.com/grafana/grafana, Github.com/elrondnetwork/elrond-go476nonenew
- 20Ао «концерн Вниинс»Ос Он «стрелец»4413new
- 21npmSteal, Matrix-js-sdk, Parse-server4310nonenew
- 22Samsung MobileSamsung Mobile Devices, Samsung Pay, Com.samsung.android.waterplugin400nonenew
- 23TendaAC21 Firmware, I9 Firmware, AC18 Firmware3921nonenew
- 24HuaweiEmui, Harmonyos, Magic Ui379nonenew
- 25LinuxLinux Kernel, Kernel360nonenew
Severity
How this month's CVEs score on CVSS; 53 have no score yet. Severity is not exploitation.
- Critical299
- High905
- Medium900
- Low53
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-787Out-of-bounds Write268
- CWE-79XSS252
- CWE-89SQL Injection162
- CWE-125Out-of-bounds Read90
- CWE-352CSRF67
- CWE-20Improper Input Validation64
- CWE-416Use After Free60
- CWE-22Path Traversal57
- CWE-287Improper Authentication53
- CWE-200Information Exposure45
- CWE-434Unrestricted File Upload38
- CWE-61738
- CWE-862Missing Authorization38
- CWE-284Improper Access Control36
- CWE-78OS Command Injection36
- CWE-120Buffer Overflow35
- CWE-476NULL Pointer Dereference32
- CWE-122Heap Buffer Overflow31
- CWE-400Resource Consumption31
- CWE-269Improper Privilege Mgmt28
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries55218% of sector-tagged CVEs
- Operating Systems47515% of sector-tagged CVEs
- Web & CMS Plugins35311% of sector-tagged CVEs
- Mobile Apps33311% of sector-tagged CVEs
- Enterprise Software2909% of sector-tagged CVEs
- Networking Infrastructure2006% of sector-tagged CVEs
- Consumer Software1394% of sector-tagged CVEs
- Hardware Firmware1374% of sector-tagged CVEs
- DevTools & CI1244% of sector-tagged CVEs
- 6 smaller sectors414
- Not yet classified136
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 787Out-of-bounds Write | 79XSS | 89SQL Injection | 125Out-of-bounds Read | 352CSRF | 20Improper Input Validation | 416Use After Free | 22Path Traversal | 287Improper Authentication | 200Information Exposure |
|---|---|---|---|---|---|---|---|---|---|---|
| 35 | 1 | 6 | 1 | 19 | 20 | 2 | ||||
| Сообщество Свободного Программного Обеспечения | 22 | 3 | 1 | 9 | 6 | 22 | 1 | 1 | ||
| Ао «нппкт» | 26 | 1 | 5 | 1 | 7 | 28 | ||||
| Ооо «русбитех-астра» | 19 | 2 | 5 | 1 | 7 | 32 | ||||
| PyPI | 3 | 1 | 1 | 5 | 16 | 3 | 1 | |||
| Maven | 7 | 18 | 7 | 1 | 3 | 4 | ||||
| Fedoraproject | 17 | 5 | 1 | 2 | 1 | 6 | 20 | 1 | 1 | |
| Microsoft Corp | 4 | 1 | 1 | 1 | 1 | 2 | 9 | |||
| Ооо «ред Софт» | 17 | 4 | 3 | 6 | 4 | 8 | 1 | |||
| Debian | 16 | 1 | 1 | 7 | 4 | 11 | 1 | |||
| Apple | 16 | 1 | 10 | 4 | 2 | 4 | ||||
| Adobe | 15 | 13 | 26 | 1 | 5 | 1 |